diff --git a/app/src/Room.js b/app/src/Room.js index c95de412..9e62b5ab 100644 --- a/app/src/Room.js +++ b/app/src/Room.js @@ -670,7 +670,7 @@ module.exports = class Room { }); transport.on('icestatechange', (iceState) => { - log.warn('ICE state changed', { + log.debug('ICE state changed', { peer_name: peer_name, transport_id: id, iceState: iceState, diff --git a/app/src/Server.js b/app/src/Server.js index ba0dac76..dfc06cc6 100644 --- a/app/src/Server.js +++ b/app/src/Server.js @@ -497,16 +497,12 @@ function startServer() { if (OIDC.enabled) { const getDynamicConfig = (host, protocol) => { const baseURL = `${protocol}://${host}`; - const config = OIDC.baseUrlDynamic ? { ...OIDC.config, baseURL, } : OIDC.config; - - log.debug('OIDC baseURL', config.baseURL); - return config; }; @@ -571,6 +567,9 @@ function startServer() { res.redirect('/'); // Redirect to the home page after logout }); + // Favicon + app.get('/favicon.ico', (req, res) => res.status(204).end()); + // UI buttons configuration app.get('/config', (req, res) => { res.status(200).json({ message: config?.ui?.buttons || false }); @@ -628,7 +627,7 @@ function startServer() { app.post('/isRoomActive', (req, res) => { const { roomId } = checkXSS(req.body); - if (roomId && (hostCfg.protected || hostCfg.user_auth)) { + if (roomId && (hostCfg.protected || hostCfg.user_auth || OIDC.enabled)) { const roomActive = roomList.has(roomId); if (roomActive) log.debug('isRoomActive', { roomId, roomActive }); res.status(200).json({ message: roomActive }); @@ -656,9 +655,7 @@ function startServer() { } if (!Validator.isValidRoomName(room)) { - return res.status(400).json({ - message: 'Invalid Room name!\nPath traversal pattern detected!', - }); + return res.redirect('/'); } let peerUsername = ''; @@ -708,7 +705,7 @@ function startServer() { if (!allowRoomAccess && !roomAllowedForUser) { log.warn('Direct Room Join Unauthorized', room); - return OIDC.enabled ? res.redirect('/') : res.redirect('/whoAreYou/' + room); + return res.redirect('/whoAreYou/' + room); } } @@ -773,7 +770,7 @@ function startServer() { htmlInjector.injectHtml(views.room, res); } else { // Who are you? - !OIDC.enabled && hostCfg.protected ? res.redirect('/whoAreYou/' + roomId) : res.redirect('/'); + OIDC.enabled || hostCfg.protected ? res.redirect('/whoAreYou/' + roomId) : res.redirect('/'); } }); @@ -1185,12 +1182,12 @@ function startServer() { app.get('/:roomId', (req, res) => { const { roomId } = checkXSS(req.params); - if (!roomId) { - log.warn('/:roomId empty', roomId); + if (!Validator.isValidRoomName(roomId)) { + log.warn('/:roomId not valid', roomId); return res.redirect('/'); } - log.debug('Detected roomId --> redirect to /join?room=roomId'); + log.debug(`Detected roomId --> redirect to /join?room=${roomId}`); res.redirect(`/join/${roomId}`); }); diff --git a/app/src/Validator.js b/app/src/Validator.js index 075a07eb..c50f7e51 100644 --- a/app/src/Validator.js +++ b/app/src/Validator.js @@ -9,7 +9,12 @@ function isValidRoomName(input) { return false; } const room = checkXSS(input); - return !room ? false : !hasPathTraversal(room); + + if (!room || ['false', 'undefined', '', null, undefined, 'favicon.ico'].includes(room.trim().toLowerCase())) { + return false; + } + + return !hasPathTraversal(room); } function isValidRecFileNameFormat(input) { diff --git a/package-lock.json b/package-lock.json index f8cc37f2..5c5b6bdd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,19 +1,19 @@ { "name": "mirotalksfu", - "version": "1.8.80", + "version": "1.8.81", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "mirotalksfu", - "version": "1.8.80", + "version": "1.8.81", "license": "AGPL-3.0", "dependencies": { "@aws-sdk/client-s3": "^3.842.0", "@aws-sdk/lib-storage": "^3.842.0", "@mattermost/client": "10.8.0", "@ngrok/ngrok": "1.5.1", - "@sentry/node": "^9.34.0", + "@sentry/node": "^9.35.0", "async-mutex": "^0.5.0", "axios": "^1.10.0", "chokidar": "^4.0.3", @@ -3744,18 +3744,18 @@ "license": "Apache-2.0" }, "node_modules/@sentry/core": { - "version": "9.34.0", - "resolved": "https://registry.npmjs.org/@sentry/core/-/core-9.34.0.tgz", - "integrity": "sha512-M/zikVaE3KLkhCFDyrHB35sF7pVkB2RPy07BcRsdFsSsdpjoG+Zq2Sxth2tMTbjd0x9Vtb/X6LVjyCj9GSEvVg==", + "version": "9.35.0", + "resolved": "https://registry.npmjs.org/@sentry/core/-/core-9.35.0.tgz", + "integrity": "sha512-bdAtzVQZ/wn4L/m8r2OUCCG/NWr0Q8dyZDwdwvINJaMbyhDRUdQh/MWjrz+id/3JoOL1LigAyTV1h4FJDGuwUQ==", "license": "MIT", "engines": { "node": ">=18" } }, "node_modules/@sentry/node": { - "version": "9.34.0", - "resolved": "https://registry.npmjs.org/@sentry/node/-/node-9.34.0.tgz", - "integrity": "sha512-UCXcYTXVftuKV4k3mYKVq+XOvdF0jFeHopGNQojs6BtbiMdRiuo0hzFsVKojij0E3r42EcC/TNzycGbNiuHgaQ==", + "version": "9.35.0", + "resolved": "https://registry.npmjs.org/@sentry/node/-/node-9.35.0.tgz", + "integrity": "sha512-7ifFqTsa3BtZGRAgqoWqYf7OJizKSyEzQlSixgBc253wyYWiLaVJ15By9Y4ozd+PbgpOPqfDN5B45Y+OxtQnQw==", "license": "MIT", "dependencies": { "@opentelemetry/api": "^1.9.0", @@ -3788,8 +3788,8 @@ "@opentelemetry/sdk-trace-base": "^1.30.1", "@opentelemetry/semantic-conventions": "^1.34.0", "@prisma/instrumentation": "6.10.1", - "@sentry/core": "9.34.0", - "@sentry/opentelemetry": "9.34.0", + "@sentry/core": "9.35.0", + "@sentry/opentelemetry": "9.35.0", "import-in-the-middle": "^1.14.2", "minimatch": "^9.0.0" }, @@ -3807,12 +3807,12 @@ } }, "node_modules/@sentry/node/node_modules/@sentry/opentelemetry": { - "version": "9.34.0", - "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-9.34.0.tgz", - "integrity": "sha512-f1Ro8EJIN8thHO7RtdIh0dCZVU57qRdOOb6UX5VPwWcnesfY7HLtoxTpVYDG3A1vE0X2EggMenVHDfezq17/RA==", + "version": "9.35.0", + "resolved": "https://registry.npmjs.org/@sentry/opentelemetry/-/opentelemetry-9.35.0.tgz", + "integrity": "sha512-XJmSC71KaN+qwYf5EEobLDyWum4FijpIjnpTVTYOrq037uUCpxJEGtgQHq0X+DE/ycVUX/Og2PiAgTeCQEYfDg==", "license": "MIT", "dependencies": { - "@sentry/core": "9.34.0" + "@sentry/core": "9.35.0" }, "engines": { "node": ">=18" diff --git a/package.json b/package.json index 19de802f..01612d6d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "mirotalksfu", - "version": "1.8.80", + "version": "1.8.81", "description": "WebRTC SFU browser-based video calls", "main": "Server.js", "scripts": { @@ -61,7 +61,7 @@ "@aws-sdk/lib-storage": "^3.842.0", "@mattermost/client": "10.8.0", "@ngrok/ngrok": "1.5.1", - "@sentry/node": "^9.34.0", + "@sentry/node": "^9.35.0", "async-mutex": "^0.5.0", "axios": "^1.10.0", "chokidar": "^4.0.3", diff --git a/public/js/Brand.js b/public/js/Brand.js index fe943032..3a68d8af 100644 --- a/public/js/Brand.js +++ b/public/js/Brand.js @@ -64,7 +64,7 @@ let BRAND = { }, about: { imageUrl: '../images/mirotalk-logo.gif', - title: 'WebRTC SFU v1.8.80', + title: 'WebRTC SFU v1.8.81', html: `